it's the same flag position as fragment? i guess an evil packet is just being identified as one. instead of if 0x800==whatever value is marked as a fragment, so

it's the same flag position as fragment? i guess an evil packet is just being identified as one. instead of if 0x800==whatever value is marked as a fragment, some firewall just uses if 0x800!=0x0. /shrug